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Abstract 

We examine the number T of queries that a quantum 
network requires to compute several Boolean functions on 
{0, 1}^ in the black-box model. We show that, in the black- 
box model, the exponential quantum speed-up obtained for 
partial functions (i.e. problems involving a promise on the 
input) by Deutsch and Jozsa and by Simon cannot be ob- 
tained for any total function: if a quantum algorithm com- 
putes some total Boolean function f with bounded-error us- 
ing T black-box queries then there is a classical determin- 
istic algorithm that computes f exactly with 0(T 6 ) queries. 
We also give asymptotically tight characterizations of T for 
all symmetric f in the exact, zero-error, and bounded-error 
settings. Finally, we give new precise bounds for AND, OR, 
and PARITY. Our results are a quantum extension of the so- 
called polynomial method, which has been successfully ap- 
plied in classical complexity theory, and also a quantum ex- 
tension of results by Nisan about a polynomial relationship 
between randomized and deterministic decision tree com- 
plexity. 



1 Introduction 

The black-box model of computation arises when one is 
given a black-box containing an iV-tuple of Boolean vari- 
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ables X = (xq, X\, . . . , xn-i)- The box is equipped to 
output Xi on input i. We wish to determine some property 
of X, accessing the xi only through the black-box. Such 
a black-box access is called a query. A property of X is 
any Boolean function that depends on X, i.e. a property is 
a function / : {0, 1} — >{0,1}. We want to compute such 
properties using as few queries as possible. 

Consider, for example, the case where the goal is to de- 
termine whether or not X contains at least one 1 , so we want 
to compute the property OR(X) = Xq V . . . V x^-i- It is 
well known that the number of queries required to compute 
OR by any classical (deterministic or probabilistic) algo- 
rithm is <d(N). Grover JI^ ] discovered a remarkable quan- 
tum algorithm that, making queries in superposition, can be 
used to compute OR with small error probability using only 
0(y/~N) queries. This number of queries was shown to be 
asymptotically optimal [||, ||, ^7|] . 

Many other quantum algorithms can be naturally ex- 
pressed in the black-box model, such as an algorithm due to 
Simon [B2], in which one is given a function X : {0, 1}" — > 
{0, 1}™, which, technically, can also be viewed as a black- 
box X = (xq, . . . , xn-i) with N — n2 n . The black-box 
X satisfies a particular promise, and the goal is to deter- 
mine whether or not X satisfies some other property (the 
details of the promise and properties are explained in [[32|]). 
Simon's quantum algorithm is proven to yield an expo- 
nential speed-up over classical algorithms in that it makes 
(logiV) ' 1 ' queries, whereas every classical randomized 
algorithm for the same function must make queries. 
The promise means that the function / : {0, 1}^ — > {0, 1} 
is partial; it is not defined on all X £ {0, 1} N . (In the previ- 
ous example of OR, the function is total; however, the quan- 
tum speed-up is only quadratic.) Some other quantum algo- 
rithms that are naturall y e xpressed in the black-box model 
are described in [juj | @ | g || |, |, || || . 

Of course, upper bounds in the black-box model im- 
mediately yield upper bounds for the circuit description 
model in which the function X is succinctly described as 
a (log iV)°W -sized circuit computing Xi from i. On the 



other hand, lower bounds in the black-box model do not im- 
ply lower bounds in the circuit model, though they can pro- 
vide useful guidance, indicating what certain algorithmic 
approaches are capable of accomplishing. It is noteworthy 
that, at present, there is no known algorithm for computing 
OR (i.e. satisfiability) in the circuit model that is signifi- 
cantly more efficient than using the circuit solely to make 
queries (though, proving that no better algorithm exists is 
likely to be difficult, as it would imply P ^ NP). 

It should also be noted that the black-box complexity of 
a function only considers the number of queries; it does not 
capture the complexity of the auxiliary computational steps 
that have to be performed in addition to the queries. In cases 
such as OR, PARITY, MAJORITY, this auxiliary work is 
not significantly larger than the number of queries; however, 
in some cases it may be much larger. For example, consider 
the case of factoring N-bit integers. The best known algo- 
rithms for this involve <d(N) queries to determine the inte- 
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ger, followed by 2 operations in the classical case but 
only N 2 (\ogN)°^ operations in the quantum case [pUj. 
Thus, the number of queries is apparently not of primary 
importance in the case of factoring. 

In this paper, we analyze the black-box complexity of 
several functions and classes of functions in the quantum 
computation setting. In particular, we show that the kind 
of exponential quantum speed-up that Simon's algorithm 
achieves for a partial function cannot be obtained by any 
quantum algorithm for any total function: at most a polyno- 
mial speed-up is possible. We also tightly characterize the 
quantum black-box complexity of all symmetric functions, 
and obtain exact bounds for functions such as AND, OR, 
PARITY, and MAJORITY for various error models: exact, 
zero-error, bounded-error. 

An important ingredient of our approach is a reduction 
that translates quantum algorithms that make T queries into 
multilinear polynomials over the N variables of degree at 
most 2T. This is a quantum extension of the so-called 
polynomial method, which has been successfully applied 
in classical complexity theory (see [Q] for an overview). 
Also, our polynomial relationship between the quantum and 
the classical complexity is analogous to earlier results by 
Nisan [23 1, who proved a polynomial relationship between 
randomized and deterministic decision tree complexity. 

2 Summary of results 

We consider three different settings for computing / on 
{0, 1}^ in the black-box model. In the exact setting, an al- 
gorithm is required to return f(X) with certainty for every 
X. In the zero-error setting, for every X, an algorithm may 
return "inconclusive" with probability at most 1/2, but // it 
returns an answer, this must be the correct value of f(X) 
(algorithms in this setting are sometimes called Las Vegas 



algorithms). Finally, in the two-sided bounded-error set- 
ting, for every X, an algorithm must correctly return the 
answer with probability at least 2/3 (algorithms in this set- 
ting are sometimes called Monte Carlo algorithms; the 2/3 
is arbitrary). Our main results are:[] 

1 . In the black-box model, the quantum speed-up for any 
total function cannot be more than by a sixth-root. 
More specifically, if a quantum algorithm computes / 
with bounded-error probability by making T queries, 
then there is a classical deterministic algorithm that 
computes / exactly making at most 0(T 6 ) queries. 
If / is monotone then the classical algorithm needs 
at most 0(T A ) queries, and if / is symmetric then it 
needs at most 0(T 2 ) queries. 

As a by-product, we also improve the polynomial re- 
lation between the decision tree complexity D(f) and 
the approximate degree deg(f) of J25| ] from D(f) £ 
0(d7g(f) 8 ) to D{f)eO{d7g{ff). 

2. We tightly characterize the black-box complexity of all 
non-constant symmetric functions as follows. In the 
exact or zero-error settings Q(N) queries are neces- 
sary and sufficient, and in the bounded-error setting 
<d(y/N(N — r(/))) queries are necessary and suffi- 
cient, where = min{|2fc — N + 1| : / flips value 
if the Hamming weight of the input changes from k to 
k + 1} (this r(/) is a number that is low if / flips for 
inputs with Hamming weight close to N/2 p7[|). This 
should be compared with the classical bounded-error 
query complexity of such functions, which is Q(N). 
Thus, characterizes the speed-up that quantum 
algorithms give. 

An interesting example is the THRESHOLD m func- 
tion which is 1 iff its input X contains at least M Is. 
This has query complexity Q(^M(N - M + 1)). 

3. For OR, AND, PARITY, MAJORITY, we obtain the 
bounds in the table below (all given numbers are 
both necessary and sufficient). These results are all 
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Table 1. Some quantum complexities 

new, with the exception of the Q(\* r N) -bounds for 



1 A11 our results remain valid if we consider a controlled black-box, 
where the first bit of the state indicates whether the black-box is to be 
applied or not. (Thus such a black-box would map |0, i, b, z) to |0, i, b, z) 
and \l,i,b,z) to 1 1, i, 6 ffi Xi,z).) Also, our results remain valid if we 
consider mixed rather than only pure states. 



OR and AND in the bounded-error setting, which ap- 
pear in [jBJ | @ p7| . The new bounds improve 
by polylog(A) factors previous lower bound results 
from [j^], which were obtained through a reduction 
from communication complexity. The new bounds 
for PARITY were independently obtained by Farhi et 
al [@. 

Note that lower bounds for OR imply lower bounds 
for database search (where we want to find an i such 
that Xi = 1, if one exists), so exact or zero-error quan- 
tum search requires A queries, in contrast to 0(-\/A) 
queries for the bounded-error case. 

3 Preliminaries 

Our main goal in this paper is to find the number 
of queries a quantum algorithm needs to compute some 
Boolean function by relating such networks to polynomials. 
In this section we give some basic definitions and properties 
of multilinear polynomials and Boolean functions, and de- 
scribe our quantum setting. 

3.1 Boolean functions and polynomials 

We assume the following setting, mainly adapted 
from [0]. We have a vector of A Boolean variables 
X = (xo, ■ ■ ■ , xpf-i), and we want to compute a Boolean 
function / : {0, 1}* -> {0, 1} of A. Unless explicitly 
stated otherwise, / will always be total. The Hamming 
weight (number of Is) of X is denoted by \X\. For con- 
venience we will assume A even, unless explicitly stated 
otherwise. We can represent Boolean functions using A- 
variate polynomials p : ~R N — ► R. Since x k = x 
whenever x <E {0, 1}, we can restrict attention to multi- 
linear p. If p{X) = f(X) for all X G {0, 1}* then 
we say p represents f. We use deg(f) to denote the de- 
gree of a minimum-degree p that represents / (actually 
such a p is unique). If \p(X) — f(X)\ < 1/3 for all 
X G {0, 1} , we say p approximates f, and deg(f) de- 
notes the degree of a minimum-degree p that approximates 
/. For example, xqxi . . . xn-i is a multilinear polynomial 
of degree N that represents the AND-function. Similarly, 
1 — (1 — .to)(1 — xi) ... (1 — xjv-i) represents OR. The 
polynomial ^xo + §£i approximates but does not represent 
AND on 2 variables. 

Nisan and Szegedy [ |25[ Theorem 2.1] proved a general 
lower bound on the degree of any Boolean function that de- 
pends on N variables: 

Theorem 3.1 (Nisan, Szegedy) If f is a Boolean function 
that depends on N variables, then deg( f) > log A — 
O(loglogA). 



Let p : R N — * R be a polynomial. If tt is some 
permutation and X — (xq, . . . , xn-i), then tt(X) — 
(1,(0), . . . ,a; w (jv_i)). Let Sn be the set of all A! permu- 
tations. The symmetrization p s y m of p averages over all 
permutations of the input, and is defined as: 



p sym {X) 



Note that p s ^ m is a polynomial of degree at most the degree 
of p. Symmetrizing may actually lower the degree: if p — 
xq — xi, then p s y m = 0. The following lemma, originally 
due to |^o[], allows us to reduce an A-variate polynomial to 
a single- variate one. 

Lemma 3.2 (Minsky, Papert) If p : R" — > R is a multilin- 
ear polynomial, then there exists a polynomial q : R — » R, 
of degree at most the degree of p, such that p sym (X) = 
q{\X\)forallX € {0,1}*. 

Proof Let d be the degree of p s y rn 7 which is at most the 
degree of p. Let Vj denote the sum of all ( . ) products of j 
different variables, so V\ = xq + . . . + Xn-\, Vq. — Xqxi + 
xqx^ + ■ ■ ■ + xjv_iXjv_2, etc. Since p s y m is symmetrical, 
it can be written as 

p s y m (X) = a + a x Vi +a 2 V 2 + ...+ a d V d , 

for some a,; € R. Note that Vj assumes value = 
\X\(\X\ - 1)(\X\ - 2) . . . (|A| - j + I)/ j\ on X, which 
is a polynomial of degree j of \X\. Therefore the single- 
variate polynomial q defined by 



q(\X\) = d + ai 



satisfies the lemma. 
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A Boolean function / is symmetric if permuting the input 
does not change the function value (i.e., /(A) only depends 
on |A|). Paturi has proved a powerful theorem that charac- 
terizes deg(f) for symmetric /. For such /, let = /(A) 
for \X\ — k, and define 

T(/) - min{|2fc-A+l| : f k £ f k+1 and < k < A-l}. 

r(/) is low if fk "jumps" near the middle (i.e., for some 
k fa A/2). Now [|7j Theorem 1] gives: 

Theorem 3.3 (Paturi) // / is a non-constant symmet- 
ric Boolean function on {0, 1}*, then deg(f) € 
e(y/N(N-T(f))). 

For functions like OR and AND, we have T(f) = A — 1 
and hence deg(f) G 9(%/A). For PARITY (which is 1 iff 
\X\ is odd) and MAJORITY (which is 1 iff \X\ > A/2), 
we have T(f) = 1 and deg(f) € 8(A). 



3.2 The framework of quantum networks 

Our goal is to compute some Boolean function / of X = 
(xo, ■ ■ ■ ,xn-i), where X is given as a black-box: calling 
the black-box on i returns the value of X{. We want to use 
as few queries as possible. 

A classical algorithm that computes / by using (adap- 
tive) black-box queries to X is called a decision tree, since it 
can be pictured as a binary tree where each node is a query, 
each node has the two outcomes of the query as children, 
and the leaves give answer ,f(X) = or f(X) = 1. The 
cost of such an algorithm is the number of queries made on 
the worst-case X, so the cost is the depth of the tree. The 
decision tree complexity D(f) of / is the cost of the best de- 
cision tree that computes /. Similarly we can define R(f) 
as the expected number of queries on the worst-case X for 
randomized algorithms that compute / with bounded-error. 

A quantum network with T queries is the quantum ana- 
logue to a classical decision tree with T queries, where 
queries and other operations can now be made in quantum 
superposition. Such a network can be represented as a se- 
quence of unitary transformations: 

U ,O 1 ,U 1 ,O 2 ,...,U T -i,Ot,Ut, 

where the Ui are arbitrary unitary transformations, and the 
Oj are unitary transformations which correspond to queries 
to X. The computation ends with some measurement or ob- 
servation of the final state. We assume each transformation 
acts on m qubits and each qubit has basis states |0) and |1), 
so there are 2 m basis states for each stage of the computa- 
tion. It will be convenient to represent each basis state as 
a binary string of length m or as the corresponding natural 
number, so we have basis states |0), |1), |2), . . . , |2 TO — 1). 
Let K be the index set {0, 1,2,..., 2 m - 1}. With some 
abuse of notation, we will sometimes identify a set of 
numbers with the corresponding set of basis states. Ev- 
ery state \(f>) of the network can be uniquely written as 
\<j>) = ^2 keK ctk\k), where the a k are complex numbers 
such that J2keK \ a k\ 2 = !■ When \<j>) is measured in the 
above basis, the probability of observing | fc) is | ctfc | 2 - Since 
we want to compute a function of X, which is given as a 
black-box, the initial state of the network is not very impor- 
tant and we will disregard it hereafter (we may assume the 
initial state to be |0) always). 

The queries are implemented using the unitary transfor- 
mations Oj in the following standard way. The transfor- 
mation Oj only affects the leftmost part of a basis state: it 
maps basis state \i,b,z) to \i, b © Xi, z) (0 denotes XOR). 
Here i has length [log N~\ bits, b is one bit, and z is an arbi- 
trary string of m — [log AT| — 1 bits. Note that the Oj are 
all equal. 

How does a quantum network compute a Boolean func- 
tion / of XI Let us designate the rightmost bit of the final 



state of the network as the output bit. More precisely, the 
output of the computation is defined to be the value we ob- 
serve if we measure the rightmost bit of the final state. If 
this output equals f(X) with certainty, for every X, then 
the network computes / exactly. If the output equals f(X) 
with probability at least 2 /3, for every X, then the network 
computes / with bounded error probability at most 1 /3. To 
define the zero-error setting, the output is obtained by ob- 
serving the two rightmost bits of the final state. If the first 
of these bits is 0, the network claims ignorance ("inconclu- 
sive"), otherwise the second bit should contain f(X) with 
certainty. For every X, the probability of getting "incon- 
clusive" should be less than 1/2. We use Qe(/), Qo(f) 
and Q2U) to denote the minimum number of queries re- 
quired by a quantum network to compute / in the exact, 
zero-error and bounded-error settings, respectively. Note 
that Q 2 (f) < Q (f) < Q E (f) < £>(/) < N. 

4 General lower bounds on the number of 
queries 

In this section we will provide some general lower 
bounds on the number of queries required to compute a 
Boolean function / on a quantum network, either exactly 
or with zero- or bounded-error probability. 

4.1 Bounds for error-free computation 

The next lemmas relate quantum networks to polynomi- 
als; they are the key to most of our results. 

Lemma 4.1 Let M be a quantum network that makes T 
queries to a black-box X. Then there exist complex-valued 
N-variate multilinear polynomials po, - ■ ■ ,P2™-h each of 
degree at most T, such that the final state of the network is 
the superposition 

5> fc poifc>, 

keK 

for any black-box X. 

Proof Let \<f>i) be the state of the network (using some 
black-box X) just before the ith query. Note that \4>i+i) = 
UiOi\cf>i). The amplitudes in \<fro) depend on the initial state 
and on Uq but not on X, so they are polynomials of X of 
degree 0. A query maps basis state \i,b,z) to \i, b © Xi, z). 
Hence if the amplitude of \i, 0, z) in |^o) is a and the am- 
plitude of \i, 1, z) is (3, then the amplitude of \i, 0, z) after 
the query becomes (1 — Xi)a + Xi/3 and the amplitude of 
\i, 1, z) becomes Xia + (1 — Xi)f3, which are polynomials 
of degree 1. (In general, if the amplitudes before a query 
are polynomials of degree < j, then the amplitudes after 
the query will be polynomials of degree < j + 1.) Between 



the first and the second query lies the unitary transformation 
U\. However, the amplitudes after applying U\ are just lin- 
ear combinations of the amplitudes before applying U\, so 
the amplitudes in \cpx) are polynomials of degree at most 1. 
Continuing in this manner, the amplitudes of the final states 
are found to be polynomials of degree at most T. We can 
make these polynomials multilinear without affecting their 
values on X E {0, 1}^, by replacing all x\ by Xi. □ 

Note that we have not used the assumption that the Uj 
are unitary, but only their linearity. The next lemma is also 
implicit in the combination of some proofs in 

Lemma 4.2 Let M be a quantum network that makes T 
queries to a black-box X, and B be a set of basis states. 
Then there exists a real-valued multilinear polynomial 
P{X) of degree at most 2T, which equals the probability 
that observing the final state of the network with black-box 
X yields a state from B. 

Proof By the previous lemma, we can write the final state 
of the network as 



keK 



for any X, where the p^ are complex-valued polynomials 
of degree < T. The probability of observing a state in B is 



P{X) 



keB 



If we split pk into its real and imaginary parts as Pk (X) = 
prk{X) + i ■ pik(X), where pr^ and pik are real-valued 
polynomials of degree < T, then \pk(X)\ 2 — (prk(X)) 2 + 
(pik(X)) 2 , which is a real-valued polynomial of degree at 
most 2T. Hence P is also a real-valued polynomial of de- 
gree at most 2T, which we can make multilinear without 
affecting its values onle {0,1}". □ 

Letting B be the set of states that have 1 as rightmost bit, 
it follows that we can write the acceptance probability of a 
network as a degree-2T polynomial P(X) of X. In the case 
of exact computation of / we must have P(X) = f(X) for 
all X, so P represents / and we obtain 2T > deg(f). 

Theorem 4.3 If f is a Boolean function, then Qe{J) > 
deg(f)/2. 

Combining this with Theorem [3.l[ we obtain a general 
lower bound: 

Corollary 4.4 Iff depends on N variables, then Q_e(/) > 
(logiV)/2-0(loglogiV). 

For symmetric f we can prove a much stronger bound. 
Firstly for the zero-error setting: 



Theorem 4.5 // / is non-constant and symmetric, then 
Qo(/)>(JV + l)/4 

Proof We assume f(X) = Ofor at least (JV+l)/2 different 
Hamming weights of X; the proof is similar if f(X) = 1 
for at least (N + 1)/2 different Hamming weights. Consider 
a network that uses T — Qo(f) queries to compute / with 
zero-error. Let B be the set of basis states that have 11 as 
rightmost bits. By Lemma 4.2, there is a real-valued mul- 



tilinear polynomial P of degree < 2T, such that for all X, 
P(X) equals the probability that the output of the network 
is 11 (i.e., that the network answers 1). Since the network 
computes / with zero-error and / is non-constant, P(X) is 
non-constant and equals on at least (N + l)/2 different 
Hamming weights (namely the Hamming weights for which 
f{X) = 0). Let q be the single-variate polynomial of de- 
gree < 2T obtained from symmetrizing P (Lemma 3.2). 
This q is non-constant and has at least (N + l)/2 zeroes, 
hence degree at least (N + l)/2, and the result follows. □ 

Thus functions like OR, AND, PARITY, threshold func- 
tions etc., all require at least (N + l)/4 queries to be com- 
puted exactly or with zero-error on a quantum network. 
Since N queries always suffice, even classically, we have 
Qe{/) G Q(N) andQo(/) € 9 (iV) for non-constant sym- 
metric /. 

Secondly, for the exact setting, we can use results by Von 
zur Gathen and Roche [[36j Theorems 2.6 and 2.8]: 

Theorem 4.6 (Von zur Gathen, Roche) If f is non- 
constant and symmetric, then deg(f) = N — O(N 054s ). 
If, in addition, N + 1 is prime, then deg(f) = N. 

Corollary 4.7 If f is non-constant and symmetric, then 
Qsif) > N/2 - 0{N a - 5i8 ). If, in addition, N + 1 is 
prime, then Qe{J) > N/2. 

In Section ^ we give more precise bounds for some par- 
ticular functions. In particular, this will show that the N/2 
lower bound is tight, as it can be met for PARITY. 

4.2 Bounds for computation with bounded-error 

Here we use similar techniques to get bounds on the 
number of queries required for bounded-error computation 
of some function. Consider the acceptance probability of a 
T-query network that computes / with bounded-error, writ- 
ten as a polynomial P(X) of degree < 2T. If f(X) = 
then we should have P(X) < 1/3, and if f(X) = 1 then 
P(X) > 2/3. Hence P approximates /, and we get: 

Theorem 4.8 If f is a Boolean function, then Q2H) > 
teg(f)/2. 



This result implies that a quantum algorithm that com- 
putes / with bounded error probability can be at most poly- 
nomially more efficient (in terms of number of queries) 
than a classical deterministic algorithm: Nisan and Szegedy 
proved that D(f) € 0{deg{ff) [g Theorem 3.9], 
which together with the previous theorem implies D(f) 6 
0(Q2{f) 8 )- The fact that there is a polynomial relation 
between the classical and the quantum complexity is also 
implicit in the generic oracle-constructions of Fortnow and 
Rogers [ 14 1. In Section || we will prove the stronger result 
D(f) e 0{Q 2 {ff). 

Combining Theorem |4. S| with Paturi's Theorem 3_3 gives 
a lower bound for symmetric functions in the bounded-error 
setting: if / is non-constant and symmetric, then Q2(f) = 
fl(-\/N(N — T(/))). We can in fact prove a matching up- 
per bound, using the following result, which follows imme- 
diately from [0| as noted by Mosca [|T[|. It shows that we 
can count the number of 1 s in X exactly, with bounded error 
probability: 

Theorem 4.9 (Brassard, H0yer, Tapp; Mosca) There ex- 
ists a quantum algorithm that returns t = \X\ 
with probability at least 3/4 using expected time 
6(V0 + l)(iV -t+l)),forallX € {0,1} N - 



Actually, the algorithms given in [T7L |2J| are classical al- 
gorithms which use some quantum networks as subroutines; 
the notion of expected time for such algorithms is the same 
as for classical ones. This counting-result allows us to prove 
the matching upper bound: 

Theorem 4.10 If f is non-constant and symmetric, then 

Q 2 (/) e e(y/N(N-r(f))). 

Proof Let / be some non-constant Boolean function. We 
will sketch a strategy that computes / with bounded error 
probability < 1/3. Let f k = f(X) for X with \X\ = k. 
First note that since T(f) = min{|2fc - N + 1| : f k ^ 
fk+i and < k < N — 1}, fk must be identically or 1 
for k e {(N - r(/))/2, . . . , (N + T(f) - 2)/2}. Consider 
some X with \X\ = t. In order to be able to compute f(X), 
it is sufficient to know t exactly if t < (N — T(f))/2 or 
t > (N + - 2)/2, or to know that (N - T(/))/2 < 

t < (N + T(f) - 2) /2 otherwise. 

Run the counting algorithm for Q(y/(N - F(f))N/2) 
steps to count the number of Is in X. If t < (N - T(/))/2 
or t > (N + - 2)/2, then with high probability the 
algorithm will have terminated and will have returned t. If it 
has not terminated after 6(>/(iV - T(f))N/2) steps, then 
we know (N-T(f))/2 < t < (N + T(f) - 2)/2 with high 
probability. 

From this application of the counting algorithm, we now 
have obtained the following with bounded error probability: 



• Ift< (N -T(f))/2 ort > (N + r(/) — 2)/2, then 
the counting algorithm gave us an exact count of t. 

• If (TV - T(/))/2 < t < (N + r(/) - 2)/2, then we 
know this, and we also know that f t is identically or 
1 for all such t. 

Thus with bounded error probability we have obtained suf- 
ficient information to compute f t = f(X), using only 
0(^/ N(N — r(/))) queries. Repeating this procedure 
some constant number of times, we can limit the probabil- 
ity of error to at most 1/3. We can implement this strategy 
in a quantum network with 0(y / N(N — queries to 

compute /. □ 

This implies that the above-stated result about quan- 
tum counting (Theorem 4.9) is optimal, since a better up- 
per bound for counting would give a better upper bound 
on Q2(f) for symmetric /, whereas we already know that 
Theorem 4.10 is tight. In contrast to Theorem 4.10, it 



can be shown that a randomized classical strategy needs 
Q(N) queries to compute any non-constant symmetric / 
with bounded-error. 

After reading a first version of this paper, where we 
proved that most functions cannot be computed exactly us- 
ing significantly fewer than N (i.e., o(N)) queries, An- 
dris Ambainis [|ljj extended this to the bounded-error case: 
most functions cannot be computed with bounded-error us- 
ing significantly fewer than N queries. 

On the other hand, Wim van Dam [[34j] recently proved 
that with good probability we can learn all N variables in 
the black-box using only A^/2 + y/N queries. This implies 
the general upper bound Q2(f) < N/2 + y/~N for any f. 
This bound is almost tight, as we will show later on that 
Q 2 (/) = A72 for/ = PARITY. 

4.3 Lower bounds in terms of block sensitivity 

Above we gave lower bounds on the number of queries 
used, in terms of degrees of polynomials that represent or 
approximate the function / that is to be computed. Here we 
give lower bounds in terms of the block sensitivity of /. 

Definition 4.11 Let f : {0,1} N ->■ {0,1} be a function, 
X £ {0, 1} N , and B C {0, . . . , N - 1} a set of indices. 
Let X B denote the vector obtained from X by flipping the 
variables in B. We say that f is sensitive to B on X if 
f(X) ^ f(X B ). The block sensitivity bs x (/) off on X is 
the maximum number t for which there exist t disjoint sets 
of indices B\. . . . , B t such that f is sensitive to each Bi 
on X. The block sensitivity bs(f) of f is the maximum of 
bs x (f) over all X S {0,1}^. 

For example, bs (OR) = N, because if we take X = 
(0, 0, ... , 0) and Bi — {%}, then flipping Bi in X flips the 
value of the OR-function from to 1 . 



We can adapt the proof of [ |25| , Lemma 3.8] on lower 
bounds of polynomials to get lower bounds on the number 
of queries in a quantum network in terms of block sensitiv- 
ity.^] The proof uses a theorem from pTT] , [28[ ] : 

Theorem 4.12 (Ehlich, Zeller; Rivlin, Cheney) Let p 

R — ► R be a polynomial such that bi < p(i) < b 2 for 
every integer < i < N, and \p'(x)\ > cfor some real 
0<x<N. Then deg(p) > y/cN/{c + b 2 - h). 

Theorem 4.13 If f is a Boolean function, then Qe{J) > 
^/bs(f)/8andQ 2 (f) > y/bs(f)/16. 

Proof We will prove the theorem for bounded-error com- 
putation, the case of exact computation is completely anal- 
ogous but slightly easier. Consider a network using T = 
Q 2 (f) queries that computes / with error probability < 
1/3. Let P be the polynomial of degree < 2T that ap- 
proximates /, obtained as for Theorem 4.8. Note that 
P(X) e [0, 1] for all X € {0, 1} N , because P represents 
a probability. Let b = bs(f), and X and Bq, . . . , £?/,_i be 
the input and sets which achieve the block sensitivity. We 
assume without loss of generality that f(X) = 0. 

Consider variable Y = (yo, . . . , yb-i) € R b . Define 



Z 
Bi 



= (zo, ■ ■ 
z-< = 1- 



, ZN-i) e R 



N 



yt if Xj = and j £ 



■ yi if Xj = 1 and j S Bi, and Zj — Xj if j $ Bi 
(the xj are fixed). Note that if Y = then Z = X, and if 
Y has yi = 1 and yj = for j ^ i then Z = X Bi . Now 
q(Y) = P(Z) is a 6-variate polynomial of degree < 2T, 
such that 

• q(Y) £ [0, 1] for all Y G {0, l} b (because P gives a 
probability). 

. |g(0) - 0| = \P(X) - f(X)\ < 1/3, so < q(6) < 
1/3. 

• \q(Y) - 1| = \P(X B ') - f(X B *)\ < 1/3 if Y has 
yi = 1 and yj = for j ^ i. 

Hence 2/3 < q(Y) < 1 if \Y\ = 1. 



Let r be the single-variate polynomial of degree < 2T 
obtained from symmetrizing q over {0, l} b (Lemma 3.2). 



Note that < r(i) < 1 for every integer < i < b, and for 
some x 6 [0, 1] we have r'(x) > 1/3 because r(0) < 1/3 
and r(l) > 2/3. Applying the previous theorem we get 
deg(r) > ^fb/Z, hence T > y/b/16. □ 

We can generalize this result to the computation of par- 
tial Boolean functions, which only work on a domain T> C 
{0, 1}^ of inputs that satisfy some promise, by generaliz- 
ing the definition of block sensitivity to partial functions in 
the obvious way. 

2 This theorem can also be proved an argument similar to the lower 
bound proof for database searching in [ 



5 Polynomial relation between classical and 
quantum complexity 

Here we will compare the classical complexities D{f) 
and R(f) with the quantum complexities. Some separa- 
tions: as we show in the next section, if / = PARITY then 
Q 2 (f) = N/2 while D(f) = N; if / = OR then Q 2 (f) e 
&{VN) by Graver's algorithm, while R(f) £ G(N) and 
D(f) — N, so we have a quadratic gap between Q 2 (f ) on 
the one hand and R(f) and D(f) on the otherj^] 

By a well-known result, the best randomized decision 
tree can be at most polynomially more efficient than the 
best deterministic decision tree: D(f) £ 0(R(f) 3 ) [ p3[ 
Theorem 4]. As mentioned in Section we can prove that 
also the quantum complexity can be at most polynomially 
better than the best deterministic tree: D(f) £ 0(Q 2 (f) 8 ). 
Here we give the stronger result that D(f) £ 0(Q 2 (f) 6 ). 
In other words, if we can compute some function quantumly 
with bounded-error using T queries, we can compute it clas- 
sically error-free with 0(T 6 ) queries. 

To start, we define the certificate complexity of /: 

Definition 5.1 Let f : {0, 1}^ — * {0, 1} be a function. A 
1-certificate is an assignment C : S — > {0,1} of values 
to some subset S of the N variables, such that f(X) = 
1 whenever X is consistent with C. The size of C is \S\. 
Similarly we define a ^-certificate. 

The certificate complexity Cx (/) of f on X is the size of 
a smallest f(X)-certificate that agrees with X. The certifi- 
cate complexity C(f ) of f is the maximum ofCx(f) over 
all X. The 1-certificate complexity C^ 1 ' (/) off is the max- 
imum ofCx (/) over all X for which f(X) = 1. 

For example, if / is the OR-function, then the certificate 
complexity on (1, 0, 0, . . . , 0) is 1, because the assignment 
xq = 1 already forces the OR to 1 . The same holds for the 
other X for which f(X) = 1, so C (1) (/) = 1. On the 
other hand, the certificate complexity on (0, 0, ... , 0) is N, 
so C(f) = N. 

The first inequality in the next lemma is obvious from 
the definitions, the second inequality is [ p3[ Lemma 2.4]. 
We give the proof for completeness. 

Lemma 5.2 (Nisan) C^\f) < C(f) < bs(f) 2 . 

Proof Consider an input X £ {0, 1} N and let B x , . . . , B b 
be disjoint minimal sets of variables that achieve the block 
sensitivity b — bsx(f) < bs(f). We will show that C : 



3 In the case of randomized decision trees, no function is known for 
which there is a quadratic gap between D(f) and R(f). The best known 
separation is for complete binary AND/OR-trees, where D(f) = N and 
R(f) S ©(iV 753 - '), and it has been conjectured that this is the best 
separation possible. This holds both for zero-error randomized trees |2^] 
and for bounded-error trees [BOI]. 



Ui-Bi — > {0, 1} which sets variables according to X, is a 
certificate for X of size < bs(f) 2 . 

Firstly, if C were not an f(X) -certificate then let X' be 
an input that agrees with C, such that f(X') ^ f(X). Let 
X' = X Bb+1 . Now / is sensitive to B b+1 on X and B b+1 
is disjoint from B\, . . . , B b , which contradicts b = bsx(f)- 
Hence C is an f(X) -certificate. 

Secondly, note that for 1 < i < b we must have 
\Bi\ < bsxBt (/): if we flip one of the ^-variables in X Bi 
then the function value must flip from f(X Bi ) to f{X) 
(otherwise Bi would not be minimal), so every ^-variable 
forms a sensitive set for / on input X Bi . Hence the size of 
Cis | UiBi\ = £-=i \Bi\ < Eli b8 XBt (J) < bs(f) 2 . □ 

The crucial lemma is the following, which we prove 
along the lines of [ |23"[ Lemma 4.1]. 

Lemma 5.3 D(f) < (f)bs(f). 

Proof The following describes an algorithm to compute 
f(X), querying at most C^ 1 ' (f)bs(f) variables of X (in 
the algorithm, by a "consistent" certificate C or input Y at 
some point we mean aCorF that agrees with the values of 
all variables queried up to that point). 

1. Repeat the following at most bs(f) times: 

Pick a consistent 1 -certificate C and query those of its 
variables whose X-values are still unknown (if there 
is no such C, then return and stop); if the queried 
values agree with C then return 1 and stop. 

2. Pick a consistent Y S {0, 1}^ and return f{Y). 

The nondeterministic "pick a C" and "pick a Y" can easily 
be made deterministic by choosing the first C resp. Y in 
some fixed order. Call this algorithm A. Since A runs for 
at most bs(f) stages and each stage queries at most (/) 
variables, A queries at most C^ 1 ' (f)bs(f) variables. 

It remains to show that A always returns the right an- 
swer. If it returns an answer in step 1, this is either because 
there are no consistent 1 -certificates left (and hence f(X) 
must be 0) or because X is found to agree with a particular 
1 -certificate C; in both cases A gives the right answer. 

Now consider the case where A returns an answer in 
step 2. We will show that all consistent Y must have the 
same /-value. Suppose not. Then there are consistent Y, Y' 
with /(F) = and f(Y') = 1. A has queried b = bs(f) 
1-certificates C\, C2, ■ ■ ■ , C b . Furthermore, Y' contains a 
consistent 1 -certificate C b +\. We will derive from these Cj 
disjoint sets Bi such that / is sensitive to each Bi on Y . For 
every 1 < i < b + 1, define Bi as the set of variables on 
which Y and d disagree. Clearly, each Bi is non-empty. 
Note that Y Bi agrees with d, so f(Y Bi ) = 1 which shows 
that / is sensitive to each Bi on Y, Let v be a variable in 
some Bi (1 < i < b), then X{v) = Y{v) ^ C\(v). Now 



for j > i, Cj has been chosen consistent with all variables 
queried up to that point (including v), so we cannot have 
X(v) = Y(v) ^ Cj(v), hence v g Bj. This shows that all 
Bi and Bj are disjoint. But then / is sensitive to bs(f) + 1 
disjoint sets on Y, which is a contradiction. Accordingly, 
all consistent Y in step 2 must have the same /-value, and 
A returns the right value f(Y) — f(X) in step 2, because 
X is one of those consistent Y. □ 

The inequality of the previous lemma is tight, because if 
/ = OR, then D(f) = N, (/) = 1, bs(f) = N. 

The previous two lemmas imply D(f) < bs(f) 3 . Com- 
bining this with Theorem 4.13 (bs(f) < 16 Q2U) 2 ), we 
obtain the main result: 

Theorem 5.4 // / is a Boolean function, then D(f) < 
4096 Q 2 (/) 6 . ' 

We do not know if the 0(Q2(/) 6 )-relation is tight, 
and suspect that it is not. The best separation we know 
is for OR and similar functions, where D(f) — N and 
Q2C/O € Q(yN). However, for such symmetric Boolean 
function we can do no better than a quadratic separation: 
D(f) < N alway s holds, and we have Q 2 (f) € Q(\/F) 
by Theorem ^lC, hence D(f) e 0{Q 2 {f) 2 ) for symmet- 
ric /. For monotone Boolean functions, where the func- 
tion value either increases or decreases monotonically if 
we set more input bits to 1, we can use [23 
tion 2.2] (bs(f) = C(/)) to prove D(J) < 



Proposi- 

256 g 2 (/) 4 . 

For the case of exact computation we can also give a bet- 
ter result: Nisan and Smolensky (unpublished [24|) proved 
D{f) < 2 deg(f) 4 for any /, which together with our The- 
orem [D| yields £>(/) < 32 Qij(/) 4 . 

As a by-product, we improve the polynomial relation be- 
tween D(f) and deg(f). Nisan and Szegedy [|25[ Theo- 
rem 3.9] proved deg(f) < D(f) < 1296 deg(f) 8 . Us- 
ing our result D(f) < bs(f) 3 and Nisan and Szegedy's 
bs(f) < 6 deg(f) 2 @ Lemma 3.8] we get 



Corollary 5.5 deg(f) < D(f) < 216 deg(ff. 
6 Some particular functions 

First we will consider the OR-function, which is related 
to database search. By Grover's well-known search algo- 
rithm [|l5j U|, if at least one x$ equals 1, we can find an 
index i such that Xi = 1 with high probability of success 
in 0(>/N) queries. This implies that we can also compute 
the OR-function with high success probability in 0(y/~N): 
let Grover's algorithm genera te an index i, and return Xi. 
Since fes(OR) = N, Theorem 4.13 gives us a lower bound 



of N on computing the OR with bounded error proba- 



bility^] so we have Q2(OR) 6 Q(y/N), where classically 
we require Q(N) queries. Now suppose we want to get rid 
of the probability of error: can we compute the OR exactly 
or with zero-error using 0(\/~N) queries? If not, can quan- 
tum computation give us at least some advantage over the 
classical deterministic case? Both questions have a nega- 
tive answer: 

Proposition 6.1 Qo(OR) = N. 

Proof Consider a network that computes O R w ith zero- 
error using T — Qo(OR) queries. By Lemma 4.1, there are 
complex-valued polynomials pk of degree at most T, such 
that the final state of the network on black-box X is 



Proof Let / be PARITY on N variables. Let p be a poly- 
nomial of degree deg(f) that approximates /. Since p ap- 
proximates /, its symmetrization p s y m also approximates 
/. By Lemma 3.2, there is a polynomial q, of degree at 



\<p x ) = Y,p k (x)\k). 



Let B be the set of all basis states ending in 10 (i.e., where 
the output is the answer 0). Then for every k £ B we must 
have p k {X) = if X ^ = (0, . . . , 0), otherwise the 
probability of getting the incorrect answer on \4> x ) would 
be non-zero. On the other hand, there must be at least one 
k' E B such thatpfc/ (0) 7^ 0, since the probability of getting 
the correct answerOon \(f>°) must be non-zero. Letp(X)be 
the real part of 1 — pk> (X) /py (0). This polynomial p has 
degree at most T and represents OR. But then p must have 
degree at least deg{OR) = N, so T > N. □ 



Corollary 6.2 A quantum network for exact or zero-error 
search requires N queries. 

Under the promise that the number of solutions is either 
or K, for some fixed known K, exact search can be done 
in 0(y/N/K) queries [|T|, [I]]]. A partial bloc k sen sitivity 
argument (see the comment following Theorem 4.13 ) shows 
that this is optimal up to a multiplicative constant. 

Like the OR-function, PARITY has deg(f) = N, so 
by Theorem 4.3 exact computation requires at least N/2 
queries. This is also sufficient. It is well known that 
the XOR of 2 variables can be computed using only one 
query [0]. We can group the N variables of X as N/2 
pairs: (x , Xi), (x 2 , x 3 ), . . . , (x N - 2 , zn-i), and compute 
the XOR of all A^/2 pairs using N/2 queries. The par- 
ity of X is the parity of these N/2 XOR values, which 
can be computed without any further queries. If we allow 
bounded-error, then N/2 queries of course still suffice. It 
follows from Theorem [O] that this cannot be improved, be- 
cause c%(PARITY) = N [pel: 



Lemma 6.3 (Minsky, Papert) deg (PARITY) = N. 

4 This Q(\/]V) lower bound on search is actually quite well known 
15fl, an d i s given in a tighter form in 05L B7p, but the way we obtained it 
nere is rather different from existing proofs"^ 



most deg(f), such that q(\X\) = p s y m (X) for all inputs. 
Thus we must have \f(X) - q(\X\)\ < 1/3, so 

<?(0) < 1/3, q(l) > 2/3, . .., q(N - 1) > 2/3, 
q(N) < 1/3 (assuming N even). 

We see that the polynomial q(x) — 1/2 must have at least N 
zeroes, hence q has degree at least N and deg(f) > N. □ 

Proposition 6.4 /// is PARITY on {0, 1}^, then Q E (f) = 

Qo(/) = Q2(/)=AT/2.0 

For classical deterministic or randomized methods, 
queries are necessary in both the exact and the zero-error 
setting. (i?(PARITY) = [AT/3] because for R(f) we count 
expected number of queries.) Note that while computing 
PARITY on a quantum network is much harder than OR 
in the bounded-error setting {N/2 versus 6(y / A)), in the 
exact setting PARITY is actually easier {N/2 versus N). 

The upper bound on PARITY uses the fact that the XOR 
connective can be computed with only one query. Using 
polynomial arguments, it turns out that XOR and its nega- 
tion are the only examples among all 16 connectives where 
quantum gives an advantage over classical computation. 

Since the AND of N variables can be reduced to MA- 
JORITY on 2N - 1 variables (if we set the first N - 1 
variables to 0, then the MAJORITY of all variables equals 
the AND of the last N variables) and AND, like OR, re- 
quires N queries to be computed exactly or with zero-error, 
MAJORITY takes at least (N + l)/2 queries. Van Melke- 
beek [^5|] and Hayes and Kutin JTo| independently found an 
exact quantum algorithm that uses at most N + 1 — e(N) 
queries, where e(N) is the number of Is in the binary rep- 
resentation of N; this can save up to log N queries. For the 
zero-error case, the (N + l)/2 lower bound applies; Van 
Melkebeek, Hayes and Kutin have found an algorithm that 
works in roughly \/0.5N queries. For the bounded-error 
case, we can apply Theorem [01]: if / = MAJORITY, then 
r(/) = 1, so we need Q(N) queries. The best upper bound 
we have here is A^/2 + y/N, which follows from [p4|]. 
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